A venture capital firm set up by the Central Intelligence Agency and now supported by the CIA and other members of the intelligence community is financing a Chicago-based IT company whose software already is serving as a key component in the nascent national health information network and is poised to play a much larger role in the NHIN of the future.
While privacy advocates expressed concern over the CIA connection, several healthcare IT experts and users of the firm's software were indifferent to it because of where and how the software is used within their IT systems.
Founded in 1995, Initiate Systems is an IT vendor with operations in several industries in addition to healthcare, including banking, communications and gambling. In healthcare, Initiate is on a roll. The company's software, which employs probabilistic matching algorithms to link patients to their records, has been used for several years to locate records for RxHub, a St. Paul, Minn.-based, for-profit corporation founded in 2001 by a consortium of the nation's largest pharmacy benefit management companies. RxHub electronically checks patient eligibility for prescription drug benefits and compiles patient medication histories for its clients, including pharmacies, IT vendors and providers, via access to PBM prescription and insurance records on 160 million people.
In March, Initiate announced an agreement to provide its software to SureScripts, an Alexandria, Va.-based company founded in 2001 by the nation's two principal retail drugstore trade groups, the National Association of Chain Drug Stores and the National Community Pharmacists Association, to facilitate electronic prescribing. The SureScripts data-transfer network is fast becoming a de facto standard for e-Rx linking between clinicians and pharmacies.
Last November, Initiate announced it had contracted to supply its records-matching software to augment patient identification systems within the Veterans Health Administration, which operates more than 150 hospitals among its more than 1,300 care sites, has 7.7 million veterans enrolled as beneficiaries and boasts one of the largest and most advanced clinical IT systems in the world.
Initiate Systems' software also is being used by an industry-leading regional healthcare information organization, or RHIO, that is a participant in an HHS contract to develop prototypes of the NHIN. That RHIO, Boston-based MA-SHARE, also was a participant in a recent transcontinental data exchange demonstration sponsored by the Markle Foundation's Connecting for Health initiative. Markle, with financial help from the Robert Wood Johnson Foundation, has developed what it calls its Common Framework, as a blueprint for how a RHIO-based, national system of data exchange might work.
A CIA venture capital company
In February, Initiate received a "Series E" round of venture capital financing led by In-Q-Tel, a VC firm based in Arlington, Va., according to a company announcement. In-Q-Tel was founded in 1999 by the CIA as an independent entity, but it continues to be financed by and under charter to the spy agency, according to its Web site. In-Q-Tel and Initiate Systems both disclosed the existence of an investment relationship between them in a public statement dated March 22 that was posted on their Web sites. Initiate Systems mentioned it again at the bottom of a news release issued last week.
"Initiate Systems has unique technology that enables extremely accurate and secure information sharing and entity resolution across organizations, which is of great value to the intelligence community," said Amit Yoran, president and chief executive officer of In-Q-Tel, in the March 22 statement. "After conducting a thorough technical and venture evaluation, we invested in Initiate Systems because their innovative software is the most accurate, high performance, scalable and non-intrusive and they have a proven track record of rapid deployment with a large number of commercial enterprises."
The CIA's intent in creating In-Q-Tel was to help the agency "to identify, acquire, and deploy cutting-edge technologies" by investing in start-up companies, according to the company's Web site.
An In-Q-Tel spokeswoman requested that questions about the Initiate Systems investment be submitted in writing. In response, Donald Tighe, vice president, marketing, communications and external affairs at In-Q-Tel, replied via e-mail that the company declined to disclose the dollar amount of its investment in Initiate, or the percentage of its ownership stake in the company.
In a separate e-mail, attributed to Jeff Galowich, Initiate executive vice president, Galowich said that as a privately held company, Initiate also declined to disclose the dollar amount of the In-Q-Tel investment or the percentage of ownership it received, noting, however, that the entire financing round -- its fourth -- was "relatively small," and that In-Q-Tel did not gain a seat on its six-member board of directors. According to Galowich, because In-Q-Tel performs "thorough due diligence" before investing in a company, "the public sector generally views an investment by In-Q-Tel as a 'seal of approval,' which should provide Initiate with more opportunity to sell its software into the public sector and commercial market."
According to Tighe, In-Q-Tel "is usually a minority investor, benefiting from partnerships with other, larger private-sector venture firms. In-Q-Tel does not take a majority stake in the companies in which it invests, and does not assume control of portfolio companies."
Initially, according to Tighe, In-Q-Tel "focused solely on the CIA." Now, however, with enhanced "connectivity between multiple U.S. intelligence agencies, In-Q-Tel now supports both the CIA and the broader Intelligence Community," he said.
"As a partner with each company it invests in, In-Q-Tel works with a company's board and management to help promote the company's success in both the commercial and the federal markets," Tighe said.
What about EMR data?
In-Q-Tel was asked if the intelligence community plans to use electronic medical records as data sources for electronic intelligence gathering, and if so, for what purpose, and if not, what use will it make of Initiate Systems software in a nonhealth application.
Tighe declined to comment on what use the CIA or other agencies might make of the software. "In-Q-Tel cannot answer questions regarding product usage," he said, adding "we are a private, independent strategic venture fund, with the mission of finding and delivering innovative technology solutions for general problem sets developed by the Intelligence Community. For questions regarding the Intelligence Community's use of commercial products, please contact the Intelligence Community."
Asked about its proposed uses of Initiate software, CIA spokesman Paul Gimigliano said in an e-mail, "The Intelligence Community's interest in software from Initiate Systems has nothing to do with its application to the healthcare industry. Indeed, the technology has been used in other fields. The Intelligence Community is simply looking for tools that will help it assess and verify data of its own." Gimigliano said the CIA and other intelligence services financially support In-Q-Tel as well as receive technologies acquired through the VC firm.
Scott Schumacher, senior vice president and chief scientist for Initiate Systems, said in a telephone interview that he doesn't know what the CIA's plans are for the software, just that they've asked the company to make what he characterized as a routine modification to the software to meet government security protocols and to adapt the software so that it can recognize Korean and Arabic language characters. Schumacher said Initiate plans to use the language adaptations in commercial applications with private-sector clients. Other than those customizations, the sale will be much as if Initiate were selling the CIA any other shrink-wrapped, commercial off-the-shelf application, Schumacher said.
"No one has disclosed to us what they do," he said. "We sell them software, and they use that software to manage their own data. They're going to buy our software and use it internally to do what they're going to do. It's like buying an Oracle software or a Microsoft database." Schumacher said Initiate does not offer its software to any client as an application service provider.
"We're not an ASP," he said. "We do not maintain data, and we would never offer that as a service." Schumacher said no one has asked him to install a backdoor in the software that would allow the intelligence agency to gain surreptitious access to a healthcare database. "If anybody asked that, I would no longer be with this company. I would get out of the deal and walk away," Schumacher said. And anyway, any backdoor probably wouldn't be of much use, Schumacher said.
"If they don't have access to those healthcare records, they won't get it through our software," he said. "We work behind the firewall in our customers' sites. The backdoor won't work if you can't get to the backdoor and the firewall is a fence around that backdoor. Our customers put the security around it so you couldn't get to the backdoor, if there was a backdoor, which there isn't. And as long as I'm here, there won't be. I would certainly think that any of these RHIOs would do the same thing. The only way they (the CIA or other intelligence agencies) could get records is go to those people who have the records and subpoena them."
Working toward an NHIN
In a news release July 11, Initiate Systems, RxHub and the Regenstrief Institute of Indianapolis announced they were working together to deploy "a joint system at 16 hospitals in the Indianapolis area that permits emergency room staff to access complete and accurate patient medication history information within seconds; this is a marked improvement over previous processes, which averaged 17 minutes per patient. Because EDs serve a broader audience than the local community, this deployment, which could be implemented on a national level, serves as a proof-point for the need and viability of a national health information network (NHIN)." At the bottom, the release mentioned In-Q-Tel's link to the CIA and its investment in Initiate Systems.
Several users of Initiate Systems software say they have little concern about the investment by an arm of the intelligence community in the software firm. Broadly characterized, they say that because they run Initiate's software behind their systems' firewalls, intelligence sources can't use the software to mine their data without permission.
Mark Overhage is a physician and an associate professor of medicine at the Indiana University School of Medicine in Indianapolis and a senior investigator at Regenstrief. He also serves as president and CEO of the Indiana Health Information Exchange, another RHIO in the Markle Connecting for Health demonstration project and one of the RHIOs involved in the HHS contracts to develop an NHIN prototype.
"We do not use any Initiate software for our Markle or NHIN prototype work in Indiana," Overhage said. "We do send queries to RxHub, but our agreement with them, and I assume everyone's is the same, stipulates that they -- RxHub -- and their contractors, etc., will not retain any data from the query for any reason."
"I don't worry much about the support Initiate has received," Overhage said of the In-Q-Tel investment. "They create algorithms and software and market those. Various customers license these products and install, run and manage them themselves -- Initiate doesn't have access in any way. One analogy is that the federal government buys a lot of Microsoft office products, but we don't worry that Microsoft is going to steal government secrets typed on Word."
John Halamka serves as chairman of the Health Information Technology Standards Panel, a federally funded body seeking to harmonize healthcare data standards for use in the NHIN. Halamka is a physician informaticist and chief information officer for CareGroup Healthcare System and the Harvard Medical School.
CareGroup's flagship hospital, Beth Israel Deaconess Medical Center, uses Initiate software to match patient records. Halamka also serves as CEO of MA-SHARE. MA-SHARE, Regenstrief's IHIE and the Mendocino County Health Records Exchange in Ukiah, Calif., demonstrated the feasibility of the Markle's Common Framework by swapping medical records between each other. MA-SHARE used Initiate Systems software in its leg of the Markle demonstration. The IHIE and Mendocino used their own, home-grown records-locator software. A report on the demonstration was released in April.
Halamka said, "I have no specific knowledge of the use of Initiate Systems by the CIA," but added, "I don't have specific concerns that the CIA would use this to compromise the privacy of health records." Halamka said Initiate Systems has no access to patient records stored in the Beth Israel Deaconess or MA-SHARE computer systems, and he likened buying software from Initiate Systems to buying hammers from a hardware manufacturer linked to the CIA. Both software and hammers are merely tools that, once shipped, are no longer under the maker's control, he said.
"The Initiate algorithm is simply a generic way to take a whole set of information and filter through it. It could be used to find what I call non-obvious relationships. It can do all sorts of probabilistic guessing. So, you could imagine such uses, if you had an al Qaeda operative who was married to a person who worked for an intelligence agency. There would be ways of saying, 'Oh, gee, yeah, this is a person that has some issues and I can look at relationships that might be compromising of the intelligence community.' That would be a way I could envision Initiate being used, not Initiate being used in any way to dredge healthcare data."
But privacy advocate Deborah Peel, a Texas psychiatrist and chairwoman of the Austin, Texas-based Patient Privacy Rights Foundation, called the CIA connection "outrageous," noting that it simply doesn't pass the sniff test. "Who doesn't believe if the CIA puts up that money, they won't have access?" Peel said. "I'm still not satisfied."
Access, or the lack thereof, isn't the only issue, but how the software could be modified by Initiate or the CIA for future use by the agency, based on lessons learned in healthcare, according to Joy Pritts, a lawyer specializing in privacy issues and a research associate professor with Georgetown University's Institute for Health Care Research and Policy.
"It does provide them a window into these (healthcare IT) systems," Pritts said. "If they ever decide under the Patriot Act they want access to these systems, they will know exactly what they can get and how to get it. They will know what is doable."
Schumacher, the Initiate vice president, questioned that conclusion. "I don't think that's really much of a worry," he said. "I don't think that we make that any easier or any harder than it is now. If somebody lets them in, then whatever technology they have, it's no harder or easier. I really do think the people who own the data need to protect it."
At RxHub, Initiate Systems' software sits on the RxHub computers, but Initiate doesn't have access to those computers, said Chris Van Horrick, director of marketing and communications for RxHub. The patient information stored at RxHub includes a master patient index, a file containing a patient's first and last name, their date of birth, ZIP code and sex and information about which PBM has a record on them. "Initiate doesn't hold any of the patient data," Van Horrick said. "The payers hold the data." In addition, the privacy of an individual's data is protected by terms of the contract between RxHub and Initiate, Van Horrick said, although she said she couldn't go into specifics about that contract.
As to the CIA link to Initiate's funding. "This is something that's not between RxHub and Initiate," she said.
Rob Cronin is director of corporate communications for SureScripts. "We use various technologies to deliver our services, but the makers of those technologies never have access to our systems and data, period," Cronin said. For that reason, he said, SureScripts has no problem with Initiate Systems' link to In-Q-Tel and the CIA.
Carol Diamond is managing director of the healthcare program at the Markle Foundation, which touts the privacy protections of its Common Framework in part because it specifies using probabilistic matching as a substitute for a more controversial system of tagging patient records: unique patient identifiers. Diamond, a physician, said she was unaware that the CIA-linked investment firm had helped finance Initiate Systems, even though she was familiar with In-Q-Tel and its relationship to the spy agency. In-Q-Tel once had participated in another Markle work group on national security issues, Diamond said.
Diamond said while the Common Framework calls for probabilistic matching, it doesn't specify Initiate Systems' software, noting that Regenstrief has worked for years on its own record-locator software and used it in the demonstration. In addition, the Mendocino County RHIO's record locator software used in the Markle-funded demonstration was open-source, she said.
'Agnostic about vendors'
"We stayed agnostic about vendors of software and hardware," Diamond said. "We really have designed it so people can make the decisions that are appropriate for them."
The three RHIOs in the Markle demonstration also are participants in an effort to develop a prototype for the NHIN, one of four such contracts funded by HHS. Computer Sciences Corp. of El Segundo, Calif., is the lead contractor on the effort that includes the MA-SHARE, Regenstrief/IHIE and Mendocino RHIOs. CSC reported fiscal year 2006 revenues of $14.6 billion and is a major supplier of outsourced IT services to the federal government, including the departments of defense and homeland security.
Daniel Garrett is vice president and managing director of the global health solutions practice at CSC. Garrett said the CIA link "is something I would definitely ask my team to take a look at, but what I think would come back is that it's software that's being imbedded and they (Initiate Systems) don't have access (to medical data)," Garrett said. Garrett said the CIA has a long history of involvement in product development in IT and other industries, so he is not bothered by the link.
Like Markle, the NHIN prototype being developed under the HHS contract by CSC, while specifying the use of probabilistic matching, doesn't specify Initiate Systems' product, Garrett said. "If people want to use Initiate, knock yourself out," Garrett said. "We're not advocating anyone use one software. That's just not smart for an integrator (like CSC) or an industry group."
In-Q-Tel says on its Web site that it "invests in start-up companies in order to help make innovative technology already available in the commercial market available to the Intelligence Community." One unanswered question is why the intelligence agencies' VC firm made an equity investment in 11-year-old Initiate Systems instead of buying the software in an arm?s-length purchase and development contract.
Tighe's e-mail response to that question was: "In-Q-Tel engages with (a) wide range of companies in varied development stages. Our strategic venture approach provides early access to emerging technologies in the commercial market that were otherwise unknown to the government market. In-Q-Tel identifies technology excellence, financial and commercial viability, and match customer needs to yield mission impact."
What do you think? Write us with your comments at [email protected]. Please include your name, title and hometown.